The sub-techniques beta is now live! Read the release blog post for more info.


netstat is an operating system utility that displays active TCP connections, listening ports, and network statistics. [1]

ID: S0104
Associated Software: netstat.exe
Type: TOOL
Platforms: Windows, Linux, macOS
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018

Techniques Used

Domain ID Name Use
Enterprise T1049 System Network Connections Discovery

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.[1]

Groups That Use This Software

ID Name References
G0049 OilRig [2] [3]
G0004 Ke3chang [4] [5]
G0018 admin@338 [6]
G0010 Turla [7]
G0071 Orangeworm [8]
G0096 APT41 [9]